Previously Russian hacker groups used this technique to modify the hosts file on Windows systems. The Byte Order Mark additional helps the threat actor groups to stay under the radar.
kaspersky researchers detected a new campaign that depends on targeted spear phishing deliver the corrupted files to the victim’s inbox.
When the user tries to open the ZIP file with the default explorer it crashes and shows the following error.
“Instead of having the normal ZIP header starting with the “PK” signature (0x504B), we have three extra bytes (0xEFBBBF) that represent the Byte Order Mark (BOM) usually found within UTF-8 text files. Some tools will not recognize this file as being a ZIP archive format, but will instead recognize it as a UTF-8 text file and fail to extract the malicious payload,” reads Kaspersky blog post.
But the same files can be opened through third-party utilities such as WinRAR and 7-Zip. Once the file extracted the malware get’s executed and starts the infection process. The attack primarily targets users using third-party utilities.
The malicious executable act’s as a loader to load the main payload that embedded with the main resource section.
The malware source is a DDL with BICDAT function that is encrypted with the XOR-based algorithm. Then the library downloads the second stage of the payload which is the password-protected ZIP file.
Downloaded payload contents are encrypted with the same functions as the embedded payload. After extracting all the required files, the final payload is launched with is the Banking RAT malware.
The RAT malware looks for the following information in the affected machine.
- Access card code
- Date of birth
- Account password
- Internet banking password
- Electronic signature
Indicators of compromise